exclude external email address while including multiple custodians

[David_D1]

I need to conduct a search in DA 10.0 for emails sent to or from a long list of custodians, while excluding any to or from one external email address. I've tried many different approaches but can't get any that work.

If I were to write it out as a string, I'm looking for something like the following.

To or from: (C:John Kennedy OR C:Harry Truman OR C:Theodore Roosevelt) AND NOT (HelenThomas@gmail.com)

Any advice would be appreciated.

Thanks,

David

[TonySterling]

Instead of using the To or From what if you do two searches. One for To and another for From and put the names in like so:

C:John Kennedy C:Harry Truman C:Theodore Roosevelt -HelenThomas@gmail.com

[Kenneth_Adams · Accepted solution]

I just tested something like this in my DA 10.0.4CHF3 lab.  Here are the steps you should take:

1) In the 'To or from' field, select all of the Custodians you want included.

2) Ensure this 'To or from' field has the 'Any of' operation specified.

3) Change the 'Subject or Content' field selection to 'To or from'.

4) Ensure this 'new' 'To or from' field has the 'Any of' operation specified if only 1 exclusion address is to be used or the 'All of' operation if multiple exclusion addresses are to be used.

5) In the 'new' 'To or from' field, enter the exclusion SMTP address beginning with a minus sign (i.e., -myname@mydomain.local).

6) Add any additional criteria field you might need (up to 4 are allowed).

7) Save the search to submit it for processing.

When I did this in my lab, I had my 'Save search criteria' configuration option enabled in the Configuration tab's Settings sub-tab's Diagnostics section.  this option allowed DA to create 3 files containing different views of the search criteria that was passed to the search engine.  These files all begin with Criteria_. The underscore is followed by the Search ID that you can obtain by hovering your mouse over the name of the search in the Searches tab for about 5 seconds (a pop-up balloon will appear with the Search ID and Case ID).  One of the files will have the '.txt' extension, one will have the '.xml' extension, and the 3rd will have the Search ID followed by another underscore, the word Legacy, and the '.txt' file extension.

I looked in the Criteria_#.txt file for the Native Query section to see the Boolean logic applied to the criteria.  The logic had the Custodians listed with the OR operator between each one with this section surrounded in parentheses.  The next section contained the AND NOT operator on the exclusion address.  So, for my lab using Display Name and SMTP addresses for my Custodians of my Vault Service Account and my administrative ID while excluding my lab's SMTP address for Yoda (yes, I'm a Star Wars fan), the Boolean logic was as follows:

((name:vaultadmin.kwaev7.local OR name:enterprise.vault.service OR name:a.kwadams.kwaev7.local OR name:kenneth.w.adams.admin) AND (ssid:{**} AND NOT name:yoda.kwaev7.local)

The ssid:{**} is specifying to accept any SavesetID that may be found by the search.  This parameter is built into the DA seach and cannot be removed (but can be adjusted through Custom Attribute specification).

I hope this helps.  Please let us know if it works for you as well as it did for me.